Skip the navigation

Security Ambassadors

By Deborah Radcliff
October 1, 2001 12:00 PM ET

Computerworld - A few years ago, American Family Mutual Insurance Co. ran its IT operations like most other companies do: Business units would hand down an order for a new program or functionality, and IT would build it.


And as in most large organizations, a security manager would attempt to advise developers on vulnerable points and security requirements.


But that approach stretched the lone security manager too thin, says Mike Kleckner, who held that position at American Family three years ago.


So Winnie Schumann, director of enterprise technology strategies at the Madison, Wis.-based company, decided to put security controls into the hands of the systems specialists who knew their technology the best. Then, she handed the choices of individual security controls to the business units that owned the data in question.











Security Primer


When undertaking a new development project, American Family enables the business unit project managers to set security requirements themselves. A key element is a template developed by the company's two IT security advisers that explains key terms:


Authentication:
Who are you?


Authorization:
What can you do?


Confidentiality and reliability:
Privacy and dependability


Monitoring and tracking:
What did you do?


Backup and recovery:
Rebuilding the system


Physical security:
Locking others out


Change management:
Protecting the production process


Legal requirements:
What the law expects


Training and awareness:
What you need to know


Contingency planning:
What if?


Program paybacks:

Every major business unit is already represented by the corporate security board.

Business participation in the company's security intranet pages is strong.

The corporate compliance officer even co-developed the IT security policies with Winnie Schumann, director of enterprise technology strategies.


All that was needed was someone to decipher the business needs into technical solutions and vice versa. This is where Kleckner and Leslie Peckham come in. They are now the company's information security advisers, coordinating security requirements between IT and business units.


"The business person knows the value of their data, and they know what controls are appropriate, so they should be in the driver's seat," Kleckner says.


Their biggest challenge echoes that of all IT departments: bridging the great divide between technology requirements and business requirements. Bridging this gap takes a certain amount of credibility, which comes from the backing of the most senior IT manager - in this case Schumann, who has also gathered support from the most senior company management.


Once they got this backing, Kleckner and Peckham approached this challenge on two fronts - raising IT awareness in the user community and raising business awareness in their IT support departments.



Additional Resources
Forrester Consulting - Optimizing Users and Applications in a Mobile World
WHITE PAPER
Solving application issues over the WAN requires careful consideration. Based on their independent research, Forrester Consulting offers recommendations on how to tackle application performance issues, insufficient bandwidth and the inability to quickly restore users in a disaster.

Read now.

Security KnowledgeVault
WHITE PAPER
Security is not an option. This KnowledgeVault Series offers professional advice how to be proactive in the fight against cybercrimes and multi-layered security threats; how to adopt a holistic approach to protecting and managing data; and how to hire a qualified security assessor. Make security your Number 1 priority.

Read now.

Cut Communications Costs Once and for All
WHITE PAPER
New IP-based communications systems are being deployed by small and midsized businesses at a rapid rate. Learn how these organizations are enabling faster responsiveness, creating better customer experiences, speeding office or mobile interactions, and dramatically reducing existing communications costs.

Read now.

Staff Management White Papers
Measuring up: A Global Benchmark Defining IT Asset and Service Management
Find out how your IT department's IT asset and services management strategy compares to that of your peers by using this unique tool....
Overcome Top 7 Admin Challenges of Active Directory
As Active Directory's role in the enterprise has drastically increased, so has the need to secure the data. Gain insight on creating repeatable,...
Insiders Can Ruin Your Company. Take Action.
Did you know that 80 percent of threats to an organization come from the inside? The threat from insiders is often overlooked in...
Top Solutions and Tools to Prevent Devastating Malware
Custom malware frequently goes undetected. According to Forrester Research, the best way to reduce risk of breach is to deploy file integrity monitoring...
Streamline Compliance and Increase ROI
Streamline, simplify, and automate compliance related activities; especially those that impact multiple business units. This white paper from NetIQ, outlines solutions that will...
All Staff Management White Papers
Staff Management Webcasts
Optimizing Networks for the Cloud
Join guest speaker, Rohit Mehra, IDC Director of Enterprise Communications Infrastructure, to explore current trends, discuss best practices for optimizing Data Center and...
Apps QuickStart Series Part 2: Designing and Deploying SQL Server on VMware vSphere
Download this webcast to learn about the design considerations for virtualizing SQL workloads, performance and scalability information and high-availability options, as well as...
Apps QuickStart Series Part 1: Designing and Deploying Exchange 2010 on VMware vSphere
Download this webcast to learn the virtual hardware design considerations for Exchange 2010, deployment using the building block approach, options for high-availability and...
Customer Spotlight: How IPC The Hospitalist Company Implemented Oracle on VMware
Have you been looking to hear about customer's experiences with the new VMware vCenter Site Recovery Manager product? View this webcast to learn...
Virtualize Business-Critical Applications with Confidence
Virtualizing business-critical applications has become a key focus for organizations as they move along their virtualization journey. With the launch of VMware vSphere®...
All Staff Management Webcasts
Newsletter Sign-Up

Receive the latest news test, reviews and trends on your favorite technology topics

Choose a newsletter
  1. View all newsletters | Privacy Policy
IT Jobs